Problem/Motivation

SA-CORE-2026-006's tests from the private issue have not yet been added to core.

Proposed resolution

Add the tests.

Remaining tasks

NR.

Issue fork drupal-3633170

Command icon Show commands

Start within a Git clone of the project using the version control instructions.

Or, if you do not have SSH keys set up on git.drupalcode.org:

About issue forks

Comments

xjm created an issue. See original summary.

xjm opened merge request !17562

xjm’s picture

xjm
she/her
Primary language English
commented
Status: Active » Needs review
smustgrave’s picture

smustgrave commented
Status: Needs review » Reviewed & tested by the community
Issue tags: +Needs Review Queue Initiative

Reverted the change from https://git.drupalcode.org/project/drupal/-/commit/3bad6b105f4842476c59c...
Applied the MR and ran the test locally

1) Drupal\Tests\Component\Datetime\DateTimePlusTest::testUnserializeWithInvalidDateTimeObject
Failed asserting that exception of type "TypeError" is thrown.

FAILURES!
Tests: 1, Assertions: 1, Failures: 1.

Surprised a typeError was a security vulnerability?

But simple unit test, ran instantly. LGTM.

xjm’s picture

xjm
she/her
Primary language English
commented

TypeError is the error expected now that the vulnerability is fixed by failing early for invalid data, not the vulnerability itself. ;) The actual vulnerability here is evil and complicated.

  • catch committed c1f39e82 on 11.4.x 
    task: #3633170 Add test coverage for SA-CORE-2026-006

By: xjm
By:...

  • catch committed 2830e4bc on 11.5.x 
    task: #3633170 Add test coverage for SA-CORE-2026-006

By: xjm
By:...

  • catch committed ff5716ae on 11.x 
    task: #3633170 Add test coverage for SA-CORE-2026-006

By: xjm
By:...
catch’s picture

catch
he/him
Primary language English
commented
Version: main » 11.4.x-dev
Status: Reviewed & tested by the community » Fixed

Committed/pushed to main and cherry-picked back through to 11.4.x, thanks!

Now that this issue is closed, review the contribution record.

As a contributor, attribute any organization that helped you, or if you volunteered your own time.

Maintainers, credit people who helped resolve this issue.

  • catch committed 4248846d on 12.0.x 
    task: #3633170 Add test coverage for SA-CORE-2026-006

By: xjm
By:...

  • catch committed d32289b6 on main 
    task: #3633170 Add test coverage for SA-CORE-2026-006

By: xjm
By:...
catch’s picture

catch
he/him
Primary language English
commented
Status: Reviewed & tested by the community » Fixed

Committed/pushed to main and cherry-picked back through to 11.4.x, thanks!

Now that this issue is closed, review the contribution record.

As a contributor, attribute any organization that helped you, or if you volunteered your own time.

Maintainers, credit people who helped resolve this issue.